WatchGuard Under Siege: Critical CVSS 9.3 Zero-Day Exploited in the Wild to Hijack Corporate Firewalls

According to WatchGuard, a critical zero-day vulnerability in Fireware OS iked, tracked as CVE-2025-14733 with a CVSS score of 9.3, allows remote unauthenticated attackers to execute arbitrary code and hijack corporate Firebox firewalls. The flaw resides in the iked daemon that handles IKEv2 VPN negotiations and can be triggered by specially crafted packets sent to the firewall’s VPN interface, with persistence through a so-called “zombie” configuration scenario.

The advisory notes that threat actors are actively attempting exploitation in the wild, and WatchGuard has released patched versions 2025.1.4, 12.11.6 and 12.5.15, urging immediate upgrades. Even after patching, the advisory warns that devices may still be compromised and recommends rotating all locally stored secrets, including pre-shared keys, passwords and authentication certificates.

Administrators should review logs for signs such as an abnormally large certificate payload and apply mitigations recommended by the IoAs provided by WatchGuard.